Staff

Staff

Archives
Log in
Subscribe
October 28, 2026

A Hopkins employee uploaded 3,182 patients' records to a public AI tool

Plus an AI scribe study from Beth Israel Lahey, an AI stethoscope, and who's liable when AI gets it wrong.

StaffNo. 002 · Oct 28, 2026
01The big story
Most hospitals can't see which AI tools their staff use
On Sept. 21, an employee at Johns Hopkins Bayview Medical Center in Baltimore uploaded a spreadsheet to a public AI tool the hospital hadn't approved. It held records on 3,182 patients: names, record numbers, medications, treatment dates and the names of their doctors, according to Becker's.
Once it was uploaded, the hospital no longer controlled that data. Hopkins had the employee delete the chat, then had to ask the AI company to delete its copy.
Every one of those patients was offered a year of credit monitoring, a service that warns people when someone tries to use their identity.
This isn't rare.
32%In an October survey of 705 healthcare IT and security staff, only 32% said they can fully see which unapproved AI tools employees use.
Proofpoint and the Ponemon Institute ran the survey.
One reason is simple. A hospital can block public AI tools on its own computers, but not on your personal phone.
So the responsibility lands on you. If you use an AI app on your phone for work, your hospital may not know, until patient information ends up somewhere it shouldn't.
Hopkins says it is reinforcing staff training and its rules on unapproved apps. For you, one rule covers it: patient information only goes into AI tools your hospital has approved.
Doctors who work at more than one hospital have one more step. Each hospital approves its own tools, so an app that's approved at one can be off-limits at the next.
Section 03 shows how to put every hospital's rules on one page.
Sponsor · BLKBAG
Round at three hospitals. Bill from one app.
BLKBAG Rounds is built for doctors who track patients across hospitals, and it sends clean charges straight to your billing company. It works offline, so a dead zone doesn't cost you a charge.
Start now for free
02New tools
Heidi, an AI scribe, just got a large real-world study.
Heidi is an AI scribe: an app that listens to your visit with a patient and writes the note for you.
Beth Israel Lahey, a Boston hospital system, offered it to its clinicians as a standalone app. Across more than 1.6 million outpatient visits, heavy users spent about 2.5 fewer minutes per visit with their notes open, according to a study in Annals of Internal Medicine (Becker's).
Read that number with some care. One of the study's authors is affiliated with Heidi. And the study timed how long notes were open, not the time doctors spent correcting Heidi's drafts inside the app.
Heidi has a free plan with unlimited notes (Heidi). It works outside the hospital's electronic chart, so you could use it at every hospital, but only where each one has approved it.
Eko's new stethoscope still works when the battery dies.
The CORE 300 is a digital stethoscope: it makes heart sounds louder and sends them to Eko's AI software, which checks for heart murmurs.
It is FDA-cleared. In digital mode it amplifies sound up to 35 times, the company says, and with no battery it works as a regular stethoscope (HIT Consultant).
It costs $199, plus $119.99 a year for the software. Eko built it for loud units like the ED.
It connects to Eko's software over Bluetooth. Check that your hospitals have approved that software before you record a patient.
03Try this this week
Nothing below uses patient information.
1. Put your hospitals' AI rules on one page. Download each hospital's AI or acceptable-use policy, which is a staff document, not patient data. Paste them into ChatGPT, Claude or any AI tool with this:
I'm a physician with privileges at [number] hospitals. Below are each hospital's AI policies, labeled by hospital. Make a one-page table: for each hospital, which AI tools are approved for patient information, what is banned, whether personal phones are allowed, and who to contact with questions. If a policy doesn't say, write "not stated." Don't guess.
Keep it on your phone. Ask the privacy office at any hospital where the table says "not stated."
2. Check which apps can hear you. On an iPhone, go to Settings, then Privacy & Security, then Microphone. Turn off any AI app you wouldn't want named in a breach letter.
3. Ask your malpractice carrier one question: am I covered when an AI tool is wrong? In most states the doctor is still the liable party, the head of the Coalition for Health AI told Newsweek this week. The AMA wants that changed, and it hasn't been yet.
04Quick hits
Jefferson Health's ambient AI users closed charts up to 39% faster, an observational study in NEJM Catalyst found.
Northwell paused a unified texting platform after physicians kept using the tool they already knew.
Hackers used AI coding agents to break into at least 15 healthcare organizations in Argentina, CrowdStrike reported.
Is this useful? Hit reply and tell me what you'd want covered next.
Staff is free, and presented by BLKBAG, healthcare software for doctors.
Don't miss what's next. Subscribe to Staff:
← Newer The AMA just said AI vendors share the blame when the AI is wrong
Powered by Buttondown, the easiest way to start and grow your newsletter.